International Business Machines Corporation

Shohei Hido

Shoko Suzuki

Hisashi Kashima

Sachiko Yoshihama

Rikiya Takahashi

Toshihiro Takahashi

Tsuyoshi Ide

Akira Tajima

Yuta Tsuboi

Karim Hamzaoui

Michiaki Tatsubori

Seiji Munetoh

Naohiko Uramoto

Hirofumi Matsuzawa

Harunobu Kubo

Ysuyoshi Ide

A mechanism is provided to improve the availability of an ICS and an external system that uses data from the ICS by ensuring operation of the ICS and operation of the system even if an anomaly has occurred in a device in the ICS. The mechanism receives measured data from the plurality of devices, calculates prediction data by using the measured data and correlation information used for deriving prediction data for correlated devices, and provides the measured data and the prediction data.

Increasing availability of an industrial control system

A method applied to a computer that determines a situation of a system includes the steps of: receiving measurement data from each of a plurality of measurement targets in the system; computing a plurality of sets of anomaly values based on the measurement data and a predetermined computation algorithm according to a plurality of classifications corresponding to a plurality of properties of each measurement target; and determining the situation of the system based on the sets of anomaly values and a predetermined determination algorithm.

Method, computer program, and computer for determining system situation

In a case where supervised (learning) data is prepared and the case where test data is prepared, the data is recorded with time information attached to the data. The method includes clustering the learning data in a target class and clustering the test data in the target class. Then, the probability density for each of identified subclasses is calculated for each of time intervals having various time points and widths for the learning data, and is calculated for each of time intervals in the latest time period which have various widths, for the test data. Then, a ratio between a probability density obtained when learning is performed and a probability density obtained when testing is performed is obtained as a relative frequency in each of the time intervals for each of the subclasses. Input having a relative frequency that statistically and markedly increases is detected as an anomaly.

Information identification method, program product, and system using relative frequency

Provided is a system that generates models for classifying input data into a plurality of classes on the basis of training data previously classified into the plurality of classes. The system includes a sampling unit and a learning unit. The sampling unit samples, from the training data, a plurality of datasets each including a predetermined number of elements classified into a minority class and a corresponding number of elements classified into a majority class, the corresponding number being determined in accordance with the predetermined number. The learning unit learns each of a plurality of models for classifying the input data into the plurality of classes, by using a machine learning technique on the basis of each of the plurality of sampled datasets.

Technique for classifying data

A computer implemented method and system for calculating a degree of similarity between two graphs whose nodes are respectively given discrete labels include providing, for each of the two graphs, label values respectively to a given node and nodes adjacent thereto so that different ones of the discrete labels correspond to different ones of the label values. The nodes are sequentially tracing for each of the two graphs, and, during the tracing of the nodes, a new label value is calculated through a hash calculation using a label value of a currently visited node and also using label values of nodes adjacent to the currently visited node to update the label value to the currently visited node. The degree of similarity between the two graphs is calculated on the basis of the number of the label values having been given to nodes of the two graphs and agreeing between the two graphs.

Graph similarity calculation system, method and program

A method and an inspection apparatus for inspecting an information processing unit to which software update is applied. The apparatus includes a collection component configured to collect the behavior, for a plurality of times of software update, of the information processing unit to which one software update is applied. The apparatus also includes a determination component configured to compare the behavior collected for the plurality of times of software update to one another to determine whether the behavior of the information processing unit after the one software update is applied thereto is normal.

System for inspecting information processing unit to which software update is applied

A computer-implemented method, program, and system for calculating similarity between nodes in a graph by computer processing. The method includes: calculating a new label value of a node on the basis of a label value of a node adjacent to the node with respect to each of the nodes in one or more graphs; correcting the new label value of the adjacent node to remove an influence of the label value of a target node with respect to each of the target nodes for the calculation of the similarity between the nodes; and calculating the similarity between the target nodes by using the corrected new label value of the node adjacent to one target node and the corrected new label value of the node adjacent to another target node.

Method, program, and system for calculating similarity between nodes in graph

Different virtual labels, for example, like +1 and &#x2212;1, are assigned to two data sets. A change analysis problem for the two data sets is reduced to a supervised learning problem by using the virtual labels. Specifically, a classifier such as logical regression, decision tree and SVM is prepared and is trained by use of a data set obtained by merging the two data sets assigned the virtual labels. A feature selection function of the resultant classifier is used to rank and output both every attribute contributing to classification and its contribution rate.

Change analysis

Location estimation systems, methods, and non-transitory computer program products. The system includes: storage means provided in the computer, means for storing the vector datasets in the storage means of the computer, means for calculating the similarity between the vector dataset without any location label and each neighboring vector dataset with a location label, by using any one of a q-norm where 0&#x2266;q&#x2266;1 and an exponential attenuation function, and means for estimating the location label of the vector data without any location label from the calculated similarities.

Location estimation system, method and program

A location estimation method using label propagation. The achieved location estimation method is robust to variations in radio signal strengths and is highly accurate by using the q-norm (0&#x3c;q&#x3c;1), especially, for calculating the similarities among radio signal strength vectors. The accuracy in location estimation is further improved by putting more importance on the time-series similarities. Specifically, the time-series similarity is calculated by using time-series values indicating the temporal order of radio signal strengths during the measurement. If the time-series similarity is larger than the similarity between the radio signal strength vectors, the time-series similarity is preferentially used. The exponential attenuation function can also be used for calculating the similarities, instead of the q norm (0&#x3c;q&#x3c;1).

Growing community of inventors

Kanagawa-ken, Japan

Shohei Hido